Veracode Vulnerability DatabaseVERACODE:24599Arbitrary Code Execution
0.019 Low
EPSS
Percentile
88.5%
postgresql is vulnerable to arbitrary code execution. A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from an SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially-crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
References
git.postgresql.org/gitweb?p=postgresql.git;a=commitdiff;h=7ccb6dc2d3e266a551827bb99179708580f72431
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
lists.fedoraproject.org/pipermail/package-announce/2011-February/053817.html
lists.fedoraproject.org/pipermail/package-announce/2011-February/053888.html
lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
marc.info/?l=bugtraq&m=134124585221119&w=2
osvdb.org/70740
secunia.com/advisories/43144
secunia.com/advisories/43154
secunia.com/advisories/43155
secunia.com/advisories/43187
secunia.com/advisories/43188
secunia.com/advisories/43240
www.debian.org/security/2011/dsa-2157
www.mandriva.com/security/advisories?name=MDVSA-2011:021
www.postgresql.org/about/news.1289
www.postgresql.org/support/security
www.redhat.com/support/errata/RHSA-2011-0197.html
www.redhat.com/support/errata/RHSA-2011-0198.html
www.securityfocus.com/bid/46084
www.ubuntu.com/usn/USN-1058-1
www.vupen.com/english/advisories/2011/0262
www.vupen.com/english/advisories/2011/0278
www.vupen.com/english/advisories/2011/0283
www.vupen.com/english/advisories/2011/0287
www.vupen.com/english/advisories/2011/0299
www.vupen.com/english/advisories/2011/0303
www.vupen.com/english/advisories/2011/0349
access.redhat.com/errata/RHSA-2011:0197
access.redhat.com/security/updates/classification/#moderate
exchange.xforce.ibmcloud.com/vulnerabilities/65060
Related
